Yes, I know we have Firebase services now, but I just thought about something.
There is a function to list all the Google accounts on the phone. We can be sure these accounts belong to the current user since you cannot add them on your phone without a correct password.
So why not use one of these local Google accounts as a login identifier? Someone else cannot pretend to be us, since they have to add the account first on the phone and they cannot do that without our password.
Am I missing something here?